https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:25:39.742547+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:7519 ALSA-2022:7519 — Moderate: grafana security, bug fix, and enhancement update 2026-10-02T17:25:40.013646+00:00

Affected: AlmaLinux:8: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055348)

Security Fix(es):

* sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648) * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962) * grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673) * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698) * grafana: XSS vulnerability in data source handling (CVE-2022-21702) * grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703) * grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713) * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131) * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633) * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635) * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including…

 https://cve.radiocsirt.org/vuln/bdu:2024-02596 bdu:2024-02596 2026-10-02T17:25:40.013771+00:00 bdu:2024-02596 https://cve.radiocsirt.org/vuln/bit-grafana-2022-21673 BIT-grafana-2022-21673 — OAuth Identity Token exposure in Grafana 2026-10-02T17:25:40.013799+00:00

Affected: Bitnami: grafana

Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This can allow API token holders to retrieve data for which they may not have intended access. This attack relies on the Grafana instance having data sources that support the Forward OAuth Identity feature, the Grafana instance having a data source with the Forward OAuth Identity feature toggled on, the Grafana instance having OAuth enabled, and the Grafana instance having usable API keys. This issue has been patched in versions 7.5.13 and 8.3.4.

 https://cve.radiocsirt.org/vuln/cnvd-2022-06890 cnvd-2022-06890 2026-10-02T17:25:40.013841+00:00 cnvd-2022-06890 https://cve.radiocsirt.org/vuln/euvd-2026-234503 EUVD-2026-234503 2026-10-02T17:25:40.013866+00:00 EUVD-2026-234503 https://cve.radiocsirt.org/vuln/fkie_cve-2022-21673 fkie_cve-2022-21673 2026-10-02T17:25:40.013891+00:00

Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This can allow API token holders to retrieve data for which they may not have intended access. This attack relies on the Grafana instance having data sources that support the Forward OAuth Identity feature, the Grafana instance having a data source with the Forward OAuth Identity feature toggled on, the Grafana instance having OAuth enabled, and the Grafana instance having usable API keys. This issue has been patched in versions 7.5.13 and 8.3.4.

 https://cve.radiocsirt.org/vuln/gsd-2022-21673 gsd-2022-21673 2026-10-02T17:25:40.013938+00:00 gsd-2022-21673 https://cve.radiocsirt.org/vuln/oesa-2022-1531 OESA-2022-1531 — grafana security update 2026-10-02T17:25:40.013958+00:00

Affected: openEuler:20.03-LTS-SP1: grafana, openEuler:20.03-LTS-SP2: grafana, openEuler:20.03-LTS-SP3: grafana

Metrics dashboard and graph editor. Security Fix(es): Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This can allow API token holders to retrieve data for which they may not have intended access. This attack relies on the Grafana instance having data sources that support the Forward OAuth Identity feature, the Grafana instance having a data source with the Forward OAuth Identity feature toggled on, the Grafana instance having OAuth enabled, and the Grafana instance having usable API keys. This issue has been patched in versions 7.5.13 and 8.3.4.(CVE-2022-21673)

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11816-1 openSUSE-SU-2024:11816-1 — grafana-8.3.4-1.1 on GA media 2026-10-02T17:25:40.014020+00:00

grafana-8.3.4-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2022:0056 RHSA-2022:0056 — Red Hat Security Advisory: OpenShift Container Platform 4.10.3 security update 2026-10-02T17:25:40.014057+00:00

gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation nodejs-axios: Regular expression denial of service in trim function grafana: Snapshot authentication bypass golang: archive/zip: Reader.Open panics on empty string grafana: directory traversal vulnerability golang: net/http: limit growth of header canonicalization cache golang: syscall: don't close fd 0 on ForkExec error grafana: Forward OAuth Identity Token can allow users to access some data sources

 https://cve.radiocsirt.org/vuln/suse-fu-2022:1419-1 SUSE-FU-2022:1419-1 — Feature update for grafana 2026-10-02T17:25:40.014105+00:00

Feature update for grafana

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-21673 UBUNTU-CVE-2022-21673 2026-10-02T17:25:40.014136+00:00

Affected: Ubuntu:16.04:LTS: grafana

Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This can allow API token holders to retrieve data for which they may not have intended access. This attack relies on the Grafana instance having data sources that support the Forward OAuth Identity feature, the Grafana instance having a data source with the Forward OAuth Identity feature toggled on, the Grafana instance having OAuth enabled, and the Grafana instance having usable API keys. This issue has been patched in versions 7.5.13 and 8.3.4.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0406 WID-SEC-W-2022-0406 — Grafana: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-02T17:25:40.014173+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Grafana ausnutzen, um Sicherheitsvorkehrungen zu umgehen.